An unknown suspect used the UT Libraries interface and a fraudulent email address to launch a targeted phishing attack affecting students at the University.
UTPD first reported the attack on Aug. 13 after several students received suspicious emails with the title “*Subject: **UTexas Library System Problem*.”
According to UTPD spokeswoman Cindy Posey, the attack sends users an email that looks like it comes from the UT Libraries database. UTPD is unsure how many students have received the email, but reports have become less frequent.
“When it first arrives, it looks very legit and informs the user that their off-campus access to the UT Libraries has been compromised,” Posey said. “The link forwards to a website that offers a UT EID login.”
UTPD said students should not open or click on any links in the email and delete it instead.
James Liao, network security analyst at the Information Security Office, said students receive phishing emails frequently, although this was the first time he had heard of one using “UT Libraries” as a subject.
“People get phishing emails all the time,” Liao said. “They’re typically disguised as legitimate emails, and they’ll use the UT logo or other identifying information to make it look credible.”
According to Liao, phishing emails work by using fake interfaces to gain access to sensitive information, such as passwords, account details or credit card numbers. The attacker then uses this information to virtually impersonate victims.
“You can use directories online to get email addresses and then use Gmail or Yahoo to set up an anonymous email account and send anyone an email,” Liao said.
Liao said whoever sent the phishing emails probably gained access to the UT Libraries logo and interface by copying and pasting the web code into an email.
The Information Security Office website offers ways for students to protect themselves against phishing attacks, including making sure to use secure and encrypted websites, using an anti-virus software or firewall and being suspicious of requests for personal financial information.
Liao said one way to tell whether an email is legitimate is to put the mouse cursor over the link and see whether it links to the expected site.
If students fall victim to a phishing scam, Liao said they should immediately report the incident to whatever company the email impersonated, change their passwords and notify the Internet Crime Complaint Center.
